CVE-2021-41868

Vulnerability

In OnionShare versions 2.3 to 2.3.3 (before 2.4), the receive_mode.py module processes file uploads before verifying Flask HTTP Basic Authentication. This allows unauthenticated file uploads on non-public nodes when using the --receive option. The issue was reported in GitHub issue #1396 [4] and detailed by IHTeam [2].

Exploitation

An attacker can send a POST request to the /upload or /upload-ajax endpoints without providing the required Authorization: Basic header. The file is stored on the remote system before authentication is checked. The attack requires network access to the Tor hidden service but no credentials.

Impact

An attacker can upload arbitrary files to the OnionShare node's filesystem, potentially filling storage or uploading malicious content. The upload is performed with the privileges of the OnionShare process. No authentication bypass is needed.

Mitigation

The vulnerability is fixed in OnionShare 2.4. Users should upgrade to version 2.4 or later [1][3]. No workaround is available; users should avoid using version 2.3.x for receive functionality until they can upgrade.